R13 — Data Exfiltration

Q: How do security teams mitigate Data Exfiltration?

In CISO Game, Data Exfiltration is reduced by Prevention (40%), Detection (35%), Identity (25%) subscores. Real-world programs use the same control families, with category investments such as Advanced email security (anti-BEC), Network Detection & Response (NDR), Secure Web Gateway (SWG).

Q: Why does Data Exfiltration matter to a CISO?

Severity 9 (Catastrophic). Data exfiltration is the failure mode that turns a breach into a regulatory event. DLP (network + endpoint + cloud + email) is the technical control; data classification + minimization is the program-design lever (you can't exfiltrate data you didn't keep). The breach-disclosure clock is what the board actually feels — you have between 4 and 72 hours depending on jurisdiction.

Stress-test Data Exfiltration in the Standard run scenario Mid-size SaaS company. Balanced challenge.

Start playing →

R13 Data Severity 9 · Catastrophic

Adversary or insider extracts sensitive data via email, web upload, cloud sync, removable media, or pasted into unsanctioned tools. DLP plus identity boundary controls (CASB, ZTNA) are the prevention layer; detection catches the staging behavior. Residual remains because covert channels (DNS, screenshots, photos of screens) cannot be fully closed.

What is Data Exfiltration?

How does CISO Game model Data Exfiltration?

Exposure for R13 runs from 0 to 100, recomputed live as you buy, cancel, or reassign products. How the exposure model works →

Real-world parallel

Data exfiltration is the failure mode that turns a breach into a regulatory event. DLP (network + endpoint + cloud + email) is the technical control; data classification + minimization is the program-design lever (you can't exfiltrate data you didn't keep). The breach-disclosure clock is what the board actually feels — you have between 4 and 72 hours depending on jurisdiction.

How do security teams mitigate Data Exfiltration?

The dominant subscore levers for this risk are:

Prevention subscore — weight 40%
Detection subscore — weight 35%
Identity subscore — weight 25%

Which investments mitigate Data Exfiltration?

Products in CISO Game that reduce exposure to R13:

Which related risks should you also watch?

Risks with similar dominant subscores or shared category — addressing one often helps the others:

Why does Data Exfiltration matter to a CISO?

Data risk is what shows up in the news and the regulator's letter. Data Exfiltration compounds with disclosure timing, customer-trust impact, and downstream litigation.

How can you test your mitigation strategy?

Click Play CISO Game free to see R13 appear live in your risk register and watch each purchase move the exposure number in real time. No signup required.

Stress-test Data Exfiltration in the Standard run scenario →